Install VIGIL-MESH on Android

Prerequisites

The Android client is a native arm64 (ARMv8) build. Check these few points before installing.

• A 64-bit Android device (arm64/AArch64) — the vast majority of recent phones and tablets.
• Outbound network access: Wi-Fi, 4G or 5G. No inbound port or public IP address is required on the device side.
• An invitation or an enrollment key provided by your VIGIL-MESH workspace.
• Allowing installation from a source outside the store if you install the APK manually (see the next step).

Install the APK

Signed builds are published on the client download page. Get the arm64 APK from /download/client, then install it.

1. 1
   Download the arm64 APKFrom the device, open /download/client and get the Android build (APK, arm64). Always download it from this source to benefit from the signature.
2. 2
   Allow the installationOpen the downloaded file. Android may ask you to allow app installs for your browser or file manager: grant the one-time permission, then start the installation.
3. 3
   Check and openOnce installed, open the VIGIL-MESH app. On first launch, the device generates its node private key locally — it never leaves the phone.

Connect and enroll

Enrollment associates the device with your private network. It is the moment when the device proves its identity to the controller and receives its place on the signed network map.

1. 1
   Enter the invitationEnter the key or the invitation provided by your workspace. The app contacts the controller over an outbound connection to validate your identity.
2. 2
   Accept the VPN tunnelAndroid asks you to allow VIGIL-MESH to establish a VPN connection. Accept: this is what lets the device adopt its stable address on the private network.
3. 3
   Join the meshThe device receives its signed network map, a stable address (IPv4 in the CGNAT space 100.64.0.0/10 and IPv6 ULA) and the list of its peers. The session opens immediately through a blind relay, then switches seamlessly to a direct path when one is available — see /en/docs/reseau-mesh.

Mobile use

On mobile, the network interface changes often: you leave Wi-Fi for 4G, change cell, come back to Wi-Fi. VIGIL-MESH relies on QUIC connection migration to absorb these changes without breaking the session.

• The session survives network changes: switching from Wi-Fi to 4G/5G, or changing IP address, does not restart the negotiation and does not interrupt in-flight flows.
• The address on the private network stays stable whatever the physical network of the moment: your peers always reach the device at the same address.
• On a network that blocks UDP, the client can fall back to a tcp-only profile to remain reachable, at the cost of a bit of extra latency.